npm - @memberjunction/core-entities-server - Versions diffs - 6.1.0-edge.4 → 6.1.0-edge.6 - Mend

@memberjunction/core-entities-server 6.1.0-edge.4 → 6.1.0-edge.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (41) hide show

package/dist/custom/MJConversationDetailEntityServer.server.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MJConversationDetailEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAAE,~~0BAA0B~~,EAAE,MAAM,+BAA+B,CAAC;~~AAE3E;;;;;;;;;;;;GAYG~~;AACH,qBACa,gCAAiC,SAAQ,~~0BAA0B~~;~~IAC5E~~;;;OAGG;IACY,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQlE;;;;;;;;;;;OAWG;IACI,gCAAgC,IAAI,OAAO;CAiBrD"}
1	+ {"version":3,"file":"MJConversationDetailEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAErE,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBACa,gCAAiC,SAAQ,kCAAkC;IACpF;;;OAGG;IACY,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAQlE;;;;;;;;;;;OAWG;IACI,gCAAgC,IAAI,OAAO;CAiBrD"}

package/dist/custom/MJConversationDetailEntityServer.server.js CHANGED Viewed

@@ -6,7 +6,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 import { BaseEntity } from "@memberjunction/core";
 import { RegisterClass } from "@memberjunction/global";
-import { MJConversationDetailEntity } from "@memberjunction/core-entities";
+import { MJConversationDetailEntityExtended } from "@memberjunction/core-entities";
 /**
  * Server-side subclass of MJConversationDetailEntity that automatically tracks
  * when the original message content has been modified.
@@ -19,8 +19,20 @@ import { MJConversationDetailEntity } from "@memberjunction/core-entities";
  * UI can derive "edited after summarization" from the flag plus the row's Sequence
  * being below the current summary boundary — no summary regeneration required (the
  * summary is explicitly lossy; agents page in exact rows via the retrieval tools).
+ *
+ * Extends {@link MJConversationDetailEntityExtended} rather than the generated entity
+ * directly. Both classes register for `BaseEntity` under the key
+ * `'MJ: Conversation Details'`, and `@RegisterClass` passes `priority = 0`, which routes
+ * to the auto-increment branch — so whichever registers LAST wins outright. On the server
+ * this package loads after `@memberjunction/core-entities`, which meant this class replaced
+ * the Extended one and its `Save`/`Delete` permission gate never ran. That gate is the check
+ * that only a conversation's owner may set `UserRating` / `UserFeedback`, and that a
+ * non-owner without a resource grant cannot write at all — and it is explicitly designed to
+ * run server-side (`ProviderType === 'Database'`), which is exactly where it was being
+ * shadowed out. Inheriting composes the two behaviors instead: this class flags the edit,
+ * then delegates to the permission gate via `super.Save`.
  */
-let MJConversationDetailEntityServer = class MJConversationDetailEntityServer extends MJConversationDetailEntity {
+let MJConversationDetailEntityServer = class MJConversationDetailEntityServer extends MJConversationDetailEntityExtended {
     /**
      * Override Save to detect message changes and set the OriginalMessageChanged flag.
      * This is done as pre-processing before calling super.Save() to ensure it's a single DB round trip.

package/dist/custom/MJConversationDetailEntityServer.server.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MJConversationDetailEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,~~0BAA0B~~,EAAE,MAAM,+BAA+B,CAAC;~~AAE3E;;;;;;;;;;;;GAYG~~;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAiC,SAAQ,~~0BAA0B~~;~~IAC5E~~;;;OAGG;IACM,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,IAAI,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACvC,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,gCAAgC;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,YAAY,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA1CY,gCAAgC;IAD5C,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC;GACzC,gCAAgC,CA0C5C"}
1	+ {"version":3,"file":"MJConversationDetailEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJConversationDetailEntityServer.server.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAiC,SAAQ,kCAAkC;IACpF;;;OAGG;IACM,KAAK,CAAC,IAAI,CAAC,OAA2B;QAC3C,IAAI,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACvC,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;OAWG;IACI,gCAAgC;QACnC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,YAAY,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA1CY,gCAAgC;IAD5C,aAAa,CAAC,UAAU,EAAE,0BAA0B,CAAC;GACzC,gCAAgC,CA0C5C"}

package/dist/custom/MJRemoteOperationEntityServer.server.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import { EntityInfo, EntitySaveOptions } from "@memberjunction/core";
+import { EntityInfo, EntitySaveOptions, IEntityDataProvider } from "@memberjunction/core";
 import { MJRemoteOperationEntity, MJRemoteOperationEntity_RemoteOperationLibrary } from "@memberjunction/core-entities";
 /** The shape `GenerateCode()` returns — the AI-authored body + its explanation + the libraries it declared. */
 interface RemoteOperationGeneratedCode {
@@ -25,7 +25,7 @@ export declare class MJRemoteOperationEntityServer extends MJRemoteOperationEnti
      * is unchanged. Reset to false after every save, exactly like Action.ForceCodeGeneration.
      */
     ForceCodeGeneration: boolean;
-    constructor(Entity: EntityInfo);
+    constructor(Entity: EntityInfo, Provider?: IEntityDataProvider | null);
     /**
      * Save override: (re)generates the AI body when needed, within a transaction so a generation/save failure
      * leaves no partial state.

package/dist/custom/MJRemoteOperationEntityServer.server.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MJRemoteOperationEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJRemoteOperationEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,UAAU,EAAE,iBAAiB,EAAsB,MAAM,sBAAsB,CAAC;~~AAC3H~~,OAAO,EAAE,uBAAuB,EAAE,8CAA8C,EAAE,MAAM,+BAA+B,CAAC;AAOxH,+GAA+G;AAC/G,UAAU,4BAA4B;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,8CAA8C,EAAE,CAAC;CAC/D;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA8B,SAAQ,uBAAuB;IACtE;;;OAGG;IACI,mBAAmB,UAAS;gBAEvB,MAAM,EAAE,UAAU;~~IAS9B~~;;;OAGG;IACmB,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCzE,kIAAkI;IAClI,SAAS,CAAC,gBAAgB,IAAI,OAAO;IAQrC;;;;OAIG;IACU,YAAY,IAAI,OAAO,CAAC,4BAA4B,CAAC;IAqClE,yFAAyF;IACzF,SAAS,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IActD,2HAA2H;IAC3H,SAAS,CAAC,wBAAwB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAOtI"}
1	+ {"version":3,"file":"MJRemoteOperationEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJRemoteOperationEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,EAAsB,MAAM,sBAAsB,CAAC;AAChJ,OAAO,EAAE,uBAAuB,EAAE,8CAA8C,EAAE,MAAM,+BAA+B,CAAC;AAOxH,+GAA+G;AAC/G,UAAU,4BAA4B;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,8CAA8C,EAAE,CAAC;CAC/D;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA8B,SAAQ,uBAAuB;IACtE;;;OAGG;IACI,mBAAmB,UAAS;gBAEvB,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAE,mBAAmB,GAAG,IAAW;IAW3E;;;OAGG;IACmB,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCzE,kIAAkI;IAClI,SAAS,CAAC,gBAAgB,IAAI,OAAO;IAQrC;;;;OAIG;IACU,YAAY,IAAI,OAAO,CAAC,4BAA4B,CAAC;IAqClE,yFAAyF;IACzF,SAAS,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IActD,2HAA2H;IAC3H,SAAS,CAAC,wBAAwB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CAOtI"}

package/dist/custom/MJRemoteOperationEntityServer.server.js CHANGED Viewed

@@ -27,14 +27,16 @@ import { DocumentationEngine } from "@memberjunction/doc-utils";
  * there is no junction CRUD — `this.LibrariesObject = ...` is the whole "manage libraries" step.
  */
 let MJRemoteOperationEntityServer = class MJRemoteOperationEntityServer extends MJRemoteOperationEntity {
-    constructor(Entity) {
-        super(Entity);
+    constructor(Entity, Provider = null) {
+        super(Entity, Provider);
         /**
          * Transient (never persisted) flag — set it before `Save()` to force regeneration even when `Description`
          * is unchanged. Reset to false after every save, exactly like Action.ForceCodeGeneration.
          */
         this.ForceCodeGeneration = false;
-        // Constructor runs before the entity provider is wired, so the global Metadata is the only check available.
+        // ProviderType is process-wide; this only asserts the server subclass is not
+        // loaded in a client bundle. GetEntityObject rebinds the instance provider
+        // after construct even if a future edit drops the second argument again.
         const md = new Metadata(); // global-provider-ok: constructor-time provider-type check
         if (md.ProviderType !== 'Database') {
             throw new Error('MJRemoteOperationEntityServer is server/database-only — remove @memberjunction/core-entities-server from client applications.');
@@ -142,7 +144,7 @@ let MJRemoteOperationEntityServer = class MJRemoteOperationEntityServer extends
 MJRemoteOperationEntityServer = __decorate([
     RegisterClass(BaseEntity, 'MJ: Remote Operations') // high priority — ensure this server subclass wins over the generated entity
     ,
-    __metadata("design:paramtypes", [EntityInfo])
+    __metadata("design:paramtypes", [EntityInfo, Object])
 ], MJRemoteOperationEntityServer);
 export { MJRemoteOperationEntityServer };
 //# sourceMappingURL=MJRemoteOperationEntityServer.server.js.map

package/dist/custom/MJRemoteOperationEntityServer.server.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MJRemoteOperationEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJRemoteOperationEntityServer.server.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAwB,UAAU,~~EAAqB~~,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;~~AAC3H~~,OAAO,EAAE,uBAAuB,EAAkD,MAAM,+BAA+B,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAwD,MAAM,2BAA2B,CAAC;AAUtH;;;;;;;;;;;GAWG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,uBAAuB;IAOtE,YAAY,MAAkB;~~QAC1B~~,KAAK,CAAC,MAAM,CAAC,CAAC;~~QAPlB~~;;;WAGG;QACI,wBAAmB,GAAG,KAAK,CAAC;QAI/B,~~4GAA4G~~;~~QAC5G~~,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,2DAA2D;QACtF,IAAI,EAAE,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+HAA+H,CAAC,CAAC;QACrJ,CAAC;IACL,CAAC;IAED;;;OAGG;IACa,KAAK,CAAC,IAAI,CAAC,OAA2B;QAClD,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE1E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAgD,CAAC;QACvE,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvG,CAAC;gBACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACpC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,+CAA+C;gBACpF,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;gBACjC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,uDAAuD;YACpG,CAAC;YACD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC,+BAA+B;YAEjE,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACrC,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC;IAED,kIAAkI;IACxH,gBAAgB;QACtB,OAAO,CACH,IAAI,CAAC,cAAc,KAAK,IAAI;YAC5B,CAAC,IAAI,CAAC,UAAU;YAChB,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAC1F,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,YAAY;QACrB,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gCAAgC,CAAC,CAAC;YACpG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;YACzB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;YAE7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAItC,MAAM,CAAC,CAAC;YAEX,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;oBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE;oBACzC,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;yBACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;yBAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;iBAC1E,CAAC;YACN,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,yBAAyB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACnH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC;IAED,yFAAyF;IAC/E,iBAAiB;QACvB,OAAO;YACH,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS;YAC9C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE;YACnD,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,SAAS;YAChD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE;YACrD,kBAAkB,EAAE,IAAI,CAAC,wBAAwB,EAAE;SACtD,CAAC;IACN,CAAC;IAED,2HAA2H;IACjH,wBAAwB;QAC9B,OAAO,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAgC,EAAE,EAAE,CAAC,CAAC;YACrF,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAiC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;SACpH,CAAC,CAAC,CAAC;IACR,CAAC;CACJ,CAAA;~~AA/HY~~,6BAA6B;IADzC,aAAa,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC,6EAA6E;;qCAQzG,UAAU;GAPrB,6BAA6B,~~CA+HzC~~"}
1	+ {"version":3,"file":"MJRemoteOperationEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJRemoteOperationEntityServer.server.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAwB,UAAU,EAA0C,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChJ,OAAO,EAAE,uBAAuB,EAAkD,MAAM,+BAA+B,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAwD,MAAM,2BAA2B,CAAC;AAUtH;;;;;;;;;;;GAWG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,uBAAuB;IAOtE,YAAY,MAAkB,EAAE,WAAuC,IAAI;QACvE,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAP5B;;;WAGG;QACI,wBAAmB,GAAG,KAAK,CAAC;QAI/B,6EAA6E;QAC7E,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAC,2DAA2D;QACtF,IAAI,EAAE,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+HAA+H,CAAC,CAAC;QACrJ,CAAC;IACL,CAAC;IAED;;;OAGG;IACa,KAAK,CAAC,IAAI,CAAC,OAA2B;QAClD,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/D,MAAM,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE1E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAgD,CAAC;QACvE,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAClB,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,CAAC,IAAI,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvG,CAAC;gBACD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;gBACpC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC,+CAA+C;gBACpF,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;gBACjC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,uDAAuD;YACpG,CAAC;YACD,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC,+BAA+B;YAEjE,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YACrC,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC;IAED,kIAAkI;IACxH,gBAAgB;QACtB,OAAO,CACH,IAAI,CAAC,cAAc,KAAK,IAAI;YAC5B,CAAC,IAAI,CAAC,UAAU;YAChB,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAC1F,CAAC;IACN,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,YAAY;QACrB,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gCAAgC,CAAC,CAAC;YACpG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACpC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;YACzB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;YAE7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAItC,MAAM,CAAC,CAAC;YAEX,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,OAAO;oBACH,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;oBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE;oBACzC,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;yBACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;yBAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC;iBAC1E,CAAC;YACN,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,IAAI,yBAAyB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACnH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC;IAED,yFAAyF;IAC/E,iBAAiB;QACvB,OAAO;YACH,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,SAAS;YAC9C,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE;YACnD,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,SAAS;YAChD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE;YACrD,kBAAkB,EAAE,IAAI,CAAC,wBAAwB,EAAE;SACtD,CAAC;IACN,CAAC;IAED,2HAA2H;IACjH,wBAAwB;QAC9B,OAAO,mBAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAgC,EAAE,EAAE,CAAC,CAAC;YACrF,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAiC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;SACpH,CAAC,CAAC,CAAC;IACR,CAAC;CACJ,CAAA;AAjIY,6BAA6B;IADzC,aAAa,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC,6EAA6E;;qCAQzG,UAAU;GAPrB,6BAA6B,CAiIzC"}

package/dist/custom/MJRoleEntityServer.server.d.ts ADDED Viewed

@@ -0,0 +1,78 @@
+import { EntityDeleteOptions, EntitySaveOptions, ValidationResult } from '@memberjunction/core';
+import { MJRoleEntity } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: Roles` entity enforcing MJ's role-elevation invariant (issue #4282).
+ *
+ * WHY THIS EXISTS AT ALL. Roles are the containers the platform's authority is expressed in, and
+ * writing one was unguarded: verified against a live database, the `Developer` and `Integration`
+ * roles hold unfiltered `CanCreate`/`CanUpdate`/`CanDelete` on `MJ: Roles`, all three `Allow*API`
+ * flags are true on the entity, and no server-side subclass existed. Reproduced end to end before
+ * this class was written: a caller whose `Type` is `'User'` created a brand-new role and `Save()`
+ * returned `true`. Its sibling `MJUserRoleEntityServer` guards who may be GIVEN a role; this class
+ * guards what the roles themselves are.
+ *
+ * THE INVARIANT: **a non-Owner may not create, change or delete a role.** All three, not a subset
+ * of fields — because every field on this entity is authority-bearing:
+ *
+ *   - `Name` is what `SyncRolesUsersResolver` matches roles by (case-insensitively, in
+ *     `DoSyncRoles` / `SyncUserRoles`) and what Explorer's `resolveRoleByIDOrName` resolves against,
+ *     so renaming a role redirects which role a sync or a deep link lands on.
+ *   - `DirectoryID` is the role's identifier in the external directory used for authentication —
+ *     the mapping from an IdP group to platform authority.
+ *   - `SQLName` is what CodeGen emits `GRANT` statements against, so it decides which DATABASE role
+ *     receives object-level rights on every regenerated view and procedure.
+ *   - Creation matters even though a new role confers nothing on its own: it is step one of
+ *     "mint a role, grant it to myself, then give it permissions", and refusing it removes the
+ *     step this entity owns.
+ *   - Deletion destroys every assignment under the role at once, which is authority removal for
+ *     everyone who held it, not just the caller.
+ *
+ * Freezing only the authority-bearing fields was considered and declined: it would leave the list
+ * above to be re-derived every time a field is added to this entity, and `Description` — the only
+ * field it would keep writable — is not worth a rule with that failure mode. This shape also
+ * matches what issue #4260 chose for `MJ: Users` create/delete: refuse the operation, not a column.
+ *
+ * WHY HERE RATHER THAN IN A RESOLVER, and why `Save()` and `Delete()` are overridden alongside
+ * `Validate()`: see `MJUserEntityServer` for the full argument. `Validate()` runs inside
+ * `BaseEntity.Save()`, so the rule holds on every write path; `EntitySaveOptions.ReplayOnly`
+ * force-passes validation without calling `Validate()` (`baseEntity.ts:3725`) while still writing,
+ * and `Delete()` never consults `Validate()` at all.
+ *
+ * WHAT THIS BREAKS, deliberately. Explorer's role-management screen (`role-management.component.ts`
+ * and its `role-dialog`) has no Owner gate of its own, so a non-Owner administrator who reaches it
+ * today can create, rename and delete roles; after this change those saves are refused with the
+ * messages below. That is the same trade-off issue #4260 accepted for the user-management screen,
+ * and it is called out in this branch's changeset as an upgrade note. `SyncRoles` and
+ * `SyncRolesAndUsers` are unaffected on a default install: both carry `@RequireSystemUser()`, whose
+ * `getSystemUser()` resolves the seeded `Type='Owner'` system user. A deployment whose system user
+ * is NOT an Owner will see them fail closed — loudly, at the save.
+ *
+ * Pure: reads only the caller. No `RunView`, no provider, no engine, no I/O.
+ */
+export declare class MJRoleEntityServer extends MJRoleEntity {
+    private static readonly CREATE_REFUSED;
+    private static readonly UPDATE_REFUSED;
+    private static readonly DELETE_REFUSED;
+    Validate(): ValidationResult;
+    /**
+     * Closes the `ReplayOnly` bypass. Without this, a non-Owner could write this entity through the
+     * one option that skips `Validate()` — see the class docstring and `MJUserEntityServer.Save()`
+     * for why refusing outright beats re-running the rule in a second place.
+     */
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    /**
+     * Reports the refusal the way `MJUserEntityServer.Delete` does — a `BaseEntityResult` on the
+     * result history so `LatestResult.CompleteMessage` carries the reason, `Delete()` returning
+     * `false` on a logical rejection rather than throwing (the CLAUDE.md Save/Delete contract).
+     */
+    Delete(options?: EntityDeleteOptions): Promise<boolean>;
+    /** Records a logical refusal on the result history so `LatestResult.CompleteMessage` carries the reason. */
+    private refuse;
+    /**
+     * True when the caller is an Owner (or when there is no caller to evaluate). Identical contract,
+     * normalization and `Save()`-vs-`Delete()` reachability asymmetry as
+     * `MJUserRoleEntityServer.callerIsOwner()` — see that method's docstring.
+     */
+    private callerIsOwner;
+}
+//# sourceMappingURL=MJRoleEntityServer.server.d.ts.map

package/dist/custom/MJRoleEntityServer.server.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"MJRoleEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJRoleEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,mBAAmB,EAAE,iBAAiB,EAAsD,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAElL,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAE4B;IAElE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAG8C;IAEpF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CACuD;IAE7E,QAAQ,IAAI,gBAAgB;IAkB5C;;;;OAIG;IACmB,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzE;;;;OAIG;IACmB,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7E,4GAA4G;IAC5G,OAAO,CAAC,MAAM;IAWd;;;;OAIG;IACH,OAAO,CAAC,aAAa;CAOxB"}

package/dist/custom/MJRoleEntityServer.server.js ADDED Viewed

@@ -0,0 +1,131 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var MJRoleEntityServer_1;
+import { BaseEntity, BaseEntityResult, ValidationErrorInfo, ValidationErrorType } from '@memberjunction/core';
+import { RegisterClass } from '@memberjunction/global';
+import { MJRoleEntity } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: Roles` entity enforcing MJ's role-elevation invariant (issue #4282).
+ *
+ * WHY THIS EXISTS AT ALL. Roles are the containers the platform's authority is expressed in, and
+ * writing one was unguarded: verified against a live database, the `Developer` and `Integration`
+ * roles hold unfiltered `CanCreate`/`CanUpdate`/`CanDelete` on `MJ: Roles`, all three `Allow*API`
+ * flags are true on the entity, and no server-side subclass existed. Reproduced end to end before
+ * this class was written: a caller whose `Type` is `'User'` created a brand-new role and `Save()`
+ * returned `true`. Its sibling `MJUserRoleEntityServer` guards who may be GIVEN a role; this class
+ * guards what the roles themselves are.
+ *
+ * THE INVARIANT: **a non-Owner may not create, change or delete a role.** All three, not a subset
+ * of fields — because every field on this entity is authority-bearing:
+ *
+ *   - `Name` is what `SyncRolesUsersResolver` matches roles by (case-insensitively, in
+ *     `DoSyncRoles` / `SyncUserRoles`) and what Explorer's `resolveRoleByIDOrName` resolves against,
+ *     so renaming a role redirects which role a sync or a deep link lands on.
+ *   - `DirectoryID` is the role's identifier in the external directory used for authentication —
+ *     the mapping from an IdP group to platform authority.
+ *   - `SQLName` is what CodeGen emits `GRANT` statements against, so it decides which DATABASE role
+ *     receives object-level rights on every regenerated view and procedure.
+ *   - Creation matters even though a new role confers nothing on its own: it is step one of
+ *     "mint a role, grant it to myself, then give it permissions", and refusing it removes the
+ *     step this entity owns.
+ *   - Deletion destroys every assignment under the role at once, which is authority removal for
+ *     everyone who held it, not just the caller.
+ *
+ * Freezing only the authority-bearing fields was considered and declined: it would leave the list
+ * above to be re-derived every time a field is added to this entity, and `Description` — the only
+ * field it would keep writable — is not worth a rule with that failure mode. This shape also
+ * matches what issue #4260 chose for `MJ: Users` create/delete: refuse the operation, not a column.
+ *
+ * WHY HERE RATHER THAN IN A RESOLVER, and why `Save()` and `Delete()` are overridden alongside
+ * `Validate()`: see `MJUserEntityServer` for the full argument. `Validate()` runs inside
+ * `BaseEntity.Save()`, so the rule holds on every write path; `EntitySaveOptions.ReplayOnly`
+ * force-passes validation without calling `Validate()` (`baseEntity.ts:3725`) while still writing,
+ * and `Delete()` never consults `Validate()` at all.
+ *
+ * WHAT THIS BREAKS, deliberately. Explorer's role-management screen (`role-management.component.ts`
+ * and its `role-dialog`) has no Owner gate of its own, so a non-Owner administrator who reaches it
+ * today can create, rename and delete roles; after this change those saves are refused with the
+ * messages below. That is the same trade-off issue #4260 accepted for the user-management screen,
+ * and it is called out in this branch's changeset as an upgrade note. `SyncRoles` and
+ * `SyncRolesAndUsers` are unaffected on a default install: both carry `@RequireSystemUser()`, whose
+ * `getSystemUser()` resolves the seeded `Type='Owner'` system user. A deployment whose system user
+ * is NOT an Owner will see them fail closed — loudly, at the save.
+ *
+ * Pure: reads only the caller. No `RunView`, no provider, no engine, no I/O.
+ */
+let MJRoleEntityServer = class MJRoleEntityServer extends MJRoleEntity {
+    static { MJRoleEntityServer_1 = this; }
+    static { this.CREATE_REFUSED = 'Only an Owner may create a role. Roles are the containers MJ expresses authority in, so creating one ' +
+        'is the first step in granting authority that was not given.'; }
+    static { this.UPDATE_REFUSED = 'Only an Owner may change a role. A role\'s Name is what user/role synchronization matches on, its ' +
+        'DirectoryID maps an external directory group to this role, and its SQLName decides which database role ' +
+        'CodeGen grants object rights to — so editing any of them redirects authority.'; }
+    static { this.DELETE_REFUSED = 'Only an Owner may delete a role. Deleting one removes it from every user who holds it.'; }
+    Validate() {
+        const result = super.Validate();
+        if (!this.callerIsOwner()) {
+            // Attributed to 'ID' rather than to a value-bearing field: this is a whole-record
+            // refusal, not a complaint about any one value, and 'ID' is the field that identifies
+            // WHICH record is being refused. Same convention and reasoning as
+            // `MJUserEntityServer.validateCreateRefused`.
+            result.Errors.push(new ValidationErrorInfo('ID', this.IsSaved ? MJRoleEntityServer_1.UPDATE_REFUSED : MJRoleEntityServer_1.CREATE_REFUSED, this.ID, ValidationErrorType.Failure));
+        }
+        result.Success = result.Success && result.Errors.length === 0;
+        return result;
+    }
+    /**
+     * Closes the `ReplayOnly` bypass. Without this, a non-Owner could write this entity through the
+     * one option that skips `Validate()` — see the class docstring and `MJUserEntityServer.Save()`
+     * for why refusing outright beats re-running the rule in a second place.
+     */
+    async Save(options) {
+        if (options?.ReplayOnly && !this.callerIsOwner()) {
+            return this.refuse(this.IsSaved ? 'update' : 'create', 'Only an Owner may perform a ReplayOnly save on a role. ReplayOnly bypasses validation, which is ' +
+                'where this entity\'s role-elevation invariants are enforced.');
+        }
+        return super.Save(options);
+    }
+    /**
+     * Reports the refusal the way `MJUserEntityServer.Delete` does — a `BaseEntityResult` on the
+     * result history so `LatestResult.CompleteMessage` carries the reason, `Delete()` returning
+     * `false` on a logical rejection rather than throwing (the CLAUDE.md Save/Delete contract).
+     */
+    async Delete(options) {
+        if (!this.callerIsOwner()) {
+            return this.refuse('delete', MJRoleEntityServer_1.DELETE_REFUSED);
+        }
+        return super.Delete(options);
+    }
+    /** Records a logical refusal on the result history so `LatestResult.CompleteMessage` carries the reason. */
+    refuse(type, message) {
+        const result = new BaseEntityResult();
+        result.Success = false;
+        result.Type = type;
+        result.Message = message;
+        result.StartedAt = new Date();
+        result.EndedAt = new Date();
+        this.RegisterResultHistoryEntry(result);
+        return false;
+    }
+    /**
+     * True when the caller is an Owner (or when there is no caller to evaluate). Identical contract,
+     * normalization and `Save()`-vs-`Delete()` reachability asymmetry as
+     * `MJUserRoleEntityServer.callerIsOwner()` — see that method's docstring.
+     */
+    callerIsOwner() {
+        const caller = this.ActiveUser;
+        if (!caller) {
+            return true;
+        }
+        return caller.Type?.trim().toLowerCase() === 'owner';
+    }
+};
+MJRoleEntityServer = MJRoleEntityServer_1 = __decorate([
+    RegisterClass(BaseEntity, 'MJ: Roles')
+], MJRoleEntityServer);
+export { MJRoleEntityServer };
+//# sourceMappingURL=MJRoleEntityServer.server.js.map

package/dist/custom/MJRoleEntityServer.server.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"MJRoleEntityServer.server.js","sourceRoot":"","sources":["../../src/custom/MJRoleEntityServer.server.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAoD,mBAAmB,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAClL,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,YAAY;;aACxB,mBAAc,GAClC,uGAAuG;QACvG,6DAA6D,AAF3B,CAE4B;aAE1C,mBAAc,GAClC,oGAAoG;QACpG,yGAAyG;QACzG,+EAA+E,AAH7C,CAG8C;aAE5D,mBAAc,GAClC,wFAAwF,AADtD,CACuD;IAE7E,QAAQ;QACpB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACxB,kFAAkF;YAClF,sFAAsF;YACtF,kEAAkE;YAClE,8CAA8C;YAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CACtC,IAAI,EACJ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAkB,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAkB,CAAC,cAAc,EACpF,IAAI,CAAC,EAAE,EACP,mBAAmB,CAAC,OAAO,CAC9B,CAAC,CAAC;QACP,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,IAAI,CAAC,OAA2B;QAClD,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CACd,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAClC,kGAAkG;gBAClG,8DAA8D,CACjE,CAAC;QACN,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,OAA6B;QACtD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAkB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,IAAoC,EAAE,OAAe;QAChE,MAAM,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACtC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,aAAa;QACjB,MAAM,MAAM,GAAoB,IAAI,CAAC,UAAU,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IACzD,CAAC;;AAlFQ,kBAAkB;IAD9B,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC;GAC1B,kBAAkB,CAmF9B"}

package/dist/custom/MJUserEntityServer.server.d.ts ADDED Viewed

@@ -0,0 +1,243 @@
+import { EntityDeleteOptions, EntitySaveOptions, ValidationResult } from '@memberjunction/core';
+import { MJUserEntity } from '@memberjunction/core-entities';
+/**
+ * Server-side `MJ: Users` entity enforcing MJ's privilege-elevation invariant (issue #4260).
+ *
+ * WHY THIS EXISTS AT ALL. `User.Type` is the column every Owner check in the platform reads —
+ * `SqlLoggingConfigResolver`, magic-link `canIssueInvites`, the backup-system-user fallback in
+ * MJServer's bootstrap. Writing it is therefore equivalent to granting yourself the platform's
+ * superuser level. Nothing below this class stops that: on the baseline seed the `Developer` and
+ * `Integration` roles hold unfiltered `CanCreate`/`CanUpdate`/`CanDelete` on `MJ: Users` (verified
+ * against a live database, not just the seed), `AllowUpdateAPI`/`AllowDeleteAPI` are true on the
+ * entity, `AllowUpdateAPI` is also true on both the `Type` and `Name` fields, `Name` has no unique
+ * index, and CodeGen has already issued `GRANT EXECUTE` on the relevant stored procedures to those
+ * roles' DB roles.
+ *
+ * WHY NOT ROW-LEVEL SECURITY. MJ's only field-adjacent access control is `RowLevelSecurityFilter`,
+ * and an "own row only" update filter does NOT close this: scoping the update to the caller's own
+ * row still permits setting one's OWN `Type` to `'Owner'`. There is no per-role FIELD permission in
+ * MJ, and setting `EntityField.AllowUpdateAPI = 0` on `Type` would block Owners too, breaking every
+ * legitimate admin path. An invariant in the save/delete path is the only mechanism that expresses
+ * the actual rule.
+ *
+ * WHY HERE RATHER THAN IN A RESOLVER. `Validate()` runs inside `BaseEntity.Save()` and this class
+ * also overrides `Save()` and `Delete()`, so all five hold on every write path — GraphQL resolvers,
+ * Remote Operations, the Create/Update/Delete Record actions, metadata sync, one-off scripts — and
+ * for any role a deployment invents, not just the two seeded ones. A resolver-level check would
+ * cover one door in a building with several.
+ *
+ * The `Save()` override is what makes that sentence literally true rather than nearly true.
+ * `Validate()` alone does NOT cover every write path: `BaseEntity.Save()` force-passes validation
+ * without calling `Validate()` when `EntitySaveOptions.ReplayOnly` is set (`baseEntity.ts:3725`),
+ * and `ReplayOnly` does not suppress the write. Invariants 1-4 were therefore skippable by an
+ * option, while invariant 5 was not — `Delete()` being an override. See `Save()` below for the
+ * reachability analysis and why the fix refuses rather than re-validates.
+ *
+ * THE INVARIANTS, for a caller whose `Type` is not `'Owner'`:
+ *
+ *   1. **Creating a `MJ: Users` row at all is refused.** This is stricter than "may not create an
+ *      Owner": there are FOUR automated creators of this entity — `NewUserBase.createNewUser`
+ *      (`MJServer/src/auth/newUsers.ts`), `MagicLinkService`'s provisioning path
+ *      (`MJServer/src/auth/magicLink/MagicLinkService.ts`), and `CreateNewUserBase.createNewUser`
+ *      (`CodeGenLib/src/Misc/createNewUser.ts:33`, a CLI provisioning tool that sets `Type='Owner'`
+ *      unconditionally at `:39` — already refused for a non-Owner caller before this round,
+ *      regardless of the analysis below). The first two run as `ResolveConfiguredPrincipal(...)`,
+ *      whose ladder is: rung 1 matches the configured string against `User.Name`, rung 2 against
+ *      `User.Email` — NEITHER rung filters by `Type` (`MJServer/src/auth/principals.ts:134,141`) —
+ *      and only rungs 3-4 (System-by-ID, then lowest-ID-among-ACTIVE-Owners) guarantee an Owner.
+ *      So "no legitimate path creates a user row as a non-Owner" is NOT unconditional: it holds
+ *      only while a deployment's `contextUserForNewUserCreation` / `contextUserForProvisioning`
+ *      names an Owner-type user's `Name` or `Email` (the shipped default, `not.set@nowhere.com`,
+ *      resolves by Email to the seeded Owner, so default installs are unaffected). A deployment
+ *      that instead points either setting at a non-Owner user will have JWT auto-provisioning and
+ *      magic-link provisioning fail CLOSED at `Save()` after this change — loudly, not silently —
+ *      rather than continuing to create rows as that non-Owner; see the changeset for the upgrade
+ *      note. Separately, Explorer's user-management UI has NO Owner gate today (no such guard
+ *      exists in `user-management.component.ts` or its module), so a Developer-role non-Owner
+ *      reaches it in practice and will now receive this same create/delete refusal there — a real
+ *      consequence for such deployments, not a hypothetical one.
+ *      A FOURTH creator exists and is not config-driven: `SyncRolesUsersResolver.AddNewUsers`
+ *      (`MJServer/src/resolvers/SyncRolesUsersResolver.ts:343`), whose sibling `UpdateExistingUsers`
+ *      also sets `Name` AND `Type` unconditionally on every synced row and whose `DeleteSingleUser`
+ *      deletes. All three carry `@RequireSystemUser()`, and `getSystemUser()` resolves the seeded
+ *      `Type='Owner'` system user, so the guard exempts them on a default install — but a deployment
+ *      whose system user is NOT an Owner will see that sync path fail closed too, for the same
+ *      reason as the config-driven pair above. Note also that `DeleteSingleUser` reads a `false`
+ *      from `Delete()` as an FK-constraint condition and downgrades to a soft delete; invariant 5
+ *      gives that same `false` a second meaning (non-Owner caller), which that call site does not
+ *      distinguish.
+ *      Refusing only `Type='Owner'` on create is NOT enough on its own: `Name` has no unique index
+ *      and both seeded non-Owner roles hold `CanCreate`, so a non-Owner could otherwise repeatedly
+ *      `Create` rows named to match the configured principal string until one sorts below the real
+ *      system user by ID — the exact principal-redirection invariant 4 (below) exists to prevent,
+ *      just reached through INSERT instead of UPDATE.
+ *   2. `Type` may not be changed on an EXISTING row. It is a two-value CHECK column
+ *      (`'User' | 'Owner'`), so any change by a non-Owner is either self-promotion or demoting
+ *      somebody else. (Creation is already covered by invariant 1, so this only needs to consider
+ *      updates.)
+ *   3. The row must be the caller's own, compared against the PRE-SAVE `ID`. `ID` is a primary-key
+ *      field — `EntityFieldInfo.ReadOnly` is `true` for `IsPrimaryKey`, and `EntityField.Value`'s
+ *      setter silently ignores writes to a `ReadOnly` field after the record's initial hydration —
+ *      so on a genuinely LOADED row `this.ID` is not reassignable through ordinary means. The
+ *      pre-save value still matters for a narrower reason: it ties this guard to the row identity
+ *      established the last time the object was actually loaded/hydrated from the database, which
+ *      is what `ResolverBase.UpdateRecord` does first for any entity with `TrackRecordChanges=1`
+ *      (as `MJ: Users` has) — rather than trusting whatever the in-memory object merely arrived
+ *      holding. If that pre-save identity cannot be established at all, the guard fails CLOSED
+ *      (refuses the save) instead of silently permitting it — see `validateOwnRowOnly`.
+ *   4. `Name` may not be changed on an existing row. Invariants 2-3 do NOT cover this — renaming
+ *      yourself is editing your own row. `resolvePrincipalFrom` (MJServer `auth/principals.ts`)
+ *      resolves `contextUserForNewUserCreation` / `contextUserForProvisioning` /
+ *      `contextUserForLookup` against `User.Name` FIRST, breaking ties by lowest ID, so a user
+ *      who can rename themselves to the configured string and who sorts below the real system
+ *      user becomes the principal the server acts as. That ordering is deliberate (backward
+ *      compatibility) and is only sound while `Name` is not writable by untrusted parties; this
+ *      invariant is what makes that true. `Name` is the login identifier — auto-provisioning sets
+ *      `Name = email` — while `FirstName` / `LastName` / `Title` are the display fields and stay
+ *      freely editable.
+ *      `Email` is the ladder's OTHER rung (`principals.ts:141`) with the IDENTICAL lack of a `Type`
+ *      filter, and is deliberately left mutable here — not overlooked. Two things narrow it: (a)
+ *      `MJ: Users.Email` carries the database's `UQ_User_Email` unique constraint, so redirecting
+ *      the Email rung to your own row requires the configured candidate to match NO active user at
+ *      all — already the misconfiguration case this file's docs (and `resolvePrincipalFrom`'s own
+ *      per-redeem logging) already surface loudly, not a quiet success path; and (b) even granting
+ *      that misconfiguration, invariants 1 and 3 mean the payoff is no longer elevation: whatever
+ *      row a provisioning path resolves its principal to, THIS guard still checks that resolved
+ *      principal's actual `Type` before permitting the write it is attempting, so a non-Owner who
+ *      gets themselves matched by the Email rung still cannot create or promote anything through
+ *      it — the provisioning operation that would have run as them instead fails CLOSED. Freezing
+ *      `Email` too would add friction to an already-narrow, already-loud misconfiguration path
+ *      without closing any route that is still open.
+ *   5. **Deleting a `MJ: Users` row at all is refused** (see the `Delete()` override below). MJ
+ *      deactivates users via `IsActive`; it does not delete them. An unguarded delete would let a
+ *      non-Owner remove ANY account — Owners included, which destroys the very accounts every
+ *      exemption above depends on.
+ *
+ * Owner-type callers are exempt from all five — CONDITIONALLY on the deployment's own configuration
+ * keeping `contextUserForNewUserCreation` / `contextUserForProvisioning` pointed at an Owner (see
+ * invariant 1 above for why that is not automatic). Provided it is, this keeps admin user management
+ * working, and it keeps auto-provisioning working — `NewUserBase.createNewUser` runs as
+ * `contextUserForNewUserCreation`, which resolves to the seeded system user (`Type='Owner'`) under
+ * the shipped default.
+ * A caller-less save (no `ActiveUser` at all — e.g. a system/CLI path running under a bound provider
+ * default) is likewise treated as exempt, though for `Save()` this is effectively decorative:
+ * `BaseEntity.CheckPermissions` already throws on a falsy `ActiveUser` and runs BEFORE `Validate()`
+ * inside `Save()`, so in production a caller-less `Save()` never reaches this guard's `Validate()`
+ * body at all — see the "no caller" test for the exact call ordering. `Delete()`'s sequencing is the
+ * OPPOSITE and the "no caller ⇒ exempt" default IS load-bearing there — see `callerIsOwner()`'s
+ * docstring.
+ *
+ * Pure: reads only this record's own field state and the caller. No `RunView`, no provider, no
+ * engine, no I/O — so it costs nothing per save/delete and is unit-testable without a database.
+ */
+export declare class MJUserEntityServer extends MJUserEntity {
+    Validate(): ValidationResult;
+    /**
+     * Refuses a `ReplayOnly` save by a non-Owner caller.
+     *
+     * WHY THIS OVERRIDE EXISTS. Invariants 1-4 are enforced in `Validate()`, and `Validate()` is the
+     * one enforcement point `BaseEntity.Save()` can be told to skip: under `EntitySaveOptions.ReplayOnly`
+     * it force-passes validation WITHOUT calling `Validate()` at all (`baseEntity.ts:3725`), and
+     * `ReplayOnly` does NOT suppress the write — the provider only uses it to bypass the
+     * `AllowUpdateAPI`/`AllowCreateAPI` gates before building and executing the SQL
+     * (`databaseProviderBase.ts:1436-1443`). So a `ReplayOnly` save skipped all four Save-side
+     * invariants while invariant 5 stayed enforced, because `Delete()` is an override and an
+     * override cannot be switched off. This restores the symmetry: now neither half depends on the
+     * caller's options.
+     *
+     * NOT CURRENTLY REACHABLE BY AN UNTRUSTED CALLER, and this is deliberately belt-and-braces
+     * rather than a live hole. Every wire path that accepts `ReplayOnly` was enumerated: the
+     * GraphQL `options___`/`DeleteOptionsInput` input exists only on the DELETE mutation (create and
+     * update carry no options input, and `ResolverBase.CreateRecord`/`UpdateRecord` call `Save()`
+     * with none); REST's `EntityCRUDHandler` does accept it, but calls `entity.Validate()`
+     * explicitly before `Save()`, so the guard still runs there; and `graphQLSystemUserClient`
+     * requires the system API key, i.e. a caller who is already superuser. The point is that the
+     * class docstring's "holds on EVERY write path" is a promise a future wire path forwarding save
+     * options would otherwise quietly break — a guard whose protection is one option away from off
+     * is not the guard this file claims to be.
+     *
+     * WHY REFUSE RATHER THAN RE-RUN THE INVARIANTS. Re-running invariants 1-4 here would duplicate
+     * `Validate()`'s logic in a second place that must then be kept in step with it — the exact
+     * duplicated-decision this repo's design rules call out. Refusing outright is smaller and
+     * strictly safer: `ReplayOnly` is a replication/replay facility for trusted sync paths, and a
+     * non-Owner has no legitimate reason to replay writes onto the user table. Owners are exempt,
+     * so replication and admin paths that run as an Owner are unaffected.
+     */
+    Save(options?: EntitySaveOptions): Promise<boolean>;
+    private refuseSave;
+    /**
+     * Refuses deletion of any `MJ: Users` row by a non-Owner caller. See invariant 5 above for why:
+     * MJ deactivates users via `IsActive` rather than deleting them, and an unguarded delete would
+     * let a non-Owner remove any account, including Owner accounts this class's other exemptions
+     * depend on.
+     *
+     * Reports the refusal the way `MJListEntityServer.Delete` does for its own row-level DELETE
+     * authorization check — a `BaseEntityResult` on the result history so `LatestResult.CompleteMessage`
+     * carries the reason (`Delete()` returns `false` on a logical rejection rather than throwing; see
+     * the CLAUDE.md Save/Delete error-handling contract) — rather than `MJUserRoutineEntityServer`'s
+     * `Delete()` override, which is FK-cleanup ordering, not an authorization decision, and reports
+     * nothing beyond a bare `false`.
+     */
+    Delete(options?: EntityDeleteOptions): Promise<boolean>;
+    private refuseDelete;
+    /**
+     * Invariant 1 — a non-Owner may not create a `MJ: Users` row at all. See the class docstring
+     * for why this is the correct scope (not merely "may not create an Owner"): `Name` has no
+     * unique index, so restricting only `Type='Owner'` on create would leave the INSERT path open
+     * to the same principal-redirection invariant 4 blocks on UPDATE.
+     */
+    private validateCreateRefused;
+    /**
+     * Invariant 2 — a non-Owner may not change `Type` on an EXISTING row (self-promotion, or
+     * demoting somebody else). Non-Owner creation is refused entirely by `validateCreateRefused`,
+     * so this method only needs to consider updates — `Validate()` only calls it on that branch.
+     */
+    private validateNoTypeChange;
+    /**
+     * Invariant 3 — a non-Owner may only modify their own user row, compared against the PRE-SAVE
+     * `ID` (see the class docstring for why the pre-save value is the meaningful comparison here).
+     *
+     * Fails CLOSED: if the pre-save identity cannot be established at all, the save is refused
+     * rather than silently permitted. This is currently unreachable in production only because
+     * `MJ: Users` has `TrackRecordChanges=1`, which forces `ResolverBase.UpdateRecord` to genuinely
+     * load the row from the database before applying edits — but that is an unrelated entity flag,
+     * not a guarantee this class should assume will always hold.
+     */
+    private validateOwnRowOnly;
+    /**
+     * Invariant 4 — a non-Owner may not change `Name` on an existing row.
+     *
+     * `Name` is the column the context-user ladder resolves against first, so it is effectively a
+     * capability name, not a display name. Non-Owner creation (where auto-provisioning legitimately
+     * sets `Name = email`) is already refused entirely by `validateCreateRefused`, so this method
+     * only runs on updates.
+     *
+     * `Email` is deliberately NOT frozen alongside `Name` — see the class docstring's invariant 4
+     * paragraph for why the ladder's other rung doesn't need the same treatment.
+     */
+    private validateNameImmutable;
+    /**
+     * True when the caller is an Owner (or when there is no caller to evaluate — the guard has
+     * nothing to compare against).
+     *
+     * The "no caller ⇒ exempt" default has DIFFERENT reachability for `Save()` vs. `Delete()`:
+     *   - `Save()`: `BaseEntity.CheckPermissions` throws on a falsy `ActiveUser`
+     *     (`baseEntity.ts:4003-4005`) and runs at `baseEntity.ts:3702`, BEFORE `Validate()` is
+     *     called at `baseEntity.ts:3730` — so a caller-less `Save()` never reaches this method at
+     *     all in production. The default is effectively decorative there.
+     *   - `Delete()`: the sequencing is the OPPOSITE. THIS class's `Delete()` override calls
+     *     `callerIsOwner()` as its very first statement, before `super.Delete()` is ever invoked —
+     *     `CheckPermissions` only runs later, INSIDE `super.Delete()` (`baseEntity.ts:4612`). So a
+     *     caller-less `Delete()` call DOES reach this method first, and the "no caller ⇒ exempt"
+     *     default here is load-bearing: it lets the call proceed into `super.Delete()`, where
+     *     `CheckPermissions` is the thing that actually refuses it. If this default were flipped to
+     *     "no caller ⇒ refuse", a caller-less delete would be refused by `refuseDelete()` instead —
+     *     same ultimate outcome (refused), different refusal mechanism and message.
+     *
+     * `Type` is an `NCHAR` column, so it arrives space-padded; casing is normalized for the same
+     * reason `principals.ts` does. Reads `ActiveUser` rather than `ContextCurrentUser` directly so
+     * a per-request provider's `CurrentUser` is honored on multi-provider servers.
+     */
+    private callerIsOwner;
+}
+//# sourceMappingURL=MJUserEntityServer.server.d.ts.map

package/dist/custom/MJUserEntityServer.server.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"MJUserEntityServer.server.d.ts","sourceRoot":"","sources":["../../src/custom/MJUserEntityServer.server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,mBAAmB,EAAE,iBAAiB,EAA4C,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExK,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiIG;AACH,qBACa,kBAAmB,SAAQ,YAAY;IAChC,QAAQ,IAAI,gBAAgB;IAe5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACmB,IAAI,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOzE,OAAO,CAAC,UAAU;IAalB;;;;;;;;;;;;OAYG;IACmB,MAAM,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7E,OAAO,CAAC,YAAY;IAYpB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAc7B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAa5B;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB;IAc7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,aAAa;CAOxB"}